<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: Drill down into table - fields for display in Dashboards &amp; Visualizations</title>
    <link>https://community.splunk.com/t5/Dashboards-Visualizations/Drill-down-into-table-fields-for-display/m-p/98015#M5431</link>
    <description>&lt;P&gt;Nice post !&lt;/P&gt;</description>
    <pubDate>Fri, 30 Nov 2012 09:35:39 GMT</pubDate>
    <dc:creator>aneeshkjm123</dc:creator>
    <dc:date>2012-11-30T09:35:39Z</dc:date>
    <item>
      <title>Drill down into table - fields for display</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Drill-down-into-table-fields-for-display/m-p/98013#M5429</link>
      <description>&lt;P&gt;I've created a dashboard which contains a summary table for which I want to have a drill down into a second table which shows the events related to that summary record. I have the drill down working and displaying the rows needed, however it is displaying all fields for that event rather than the specific ones I've set. If I run the search query on its own through the Search app, or separately on a dashboard it displays the appropriate fields. &lt;/P&gt;

&lt;P&gt;This is the macro search code&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;source="MySource" EventClass="MyStep" $Transaction$ | dedup StepName | convert ctime(_time) as Date| table StepName, Date, EventStatus, Timing.
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;Here is the XML for the dashboard:&lt;/P&gt;

&lt;P&gt;&amp;lt;?xml version='1.0' encoding='utf-8'?&amp;gt;&lt;BR /&gt;
&amp;lt;view refresh="900" template="dashboard.html"&amp;gt;&lt;BR /&gt;
    &amp;lt;label&amp;gt;Synthetics Dashboard&amp;lt;/label&amp;gt;&lt;BR /&gt;
    &amp;lt;module name="AccountBar" layoutPanel="appHeader" /&amp;gt;&lt;BR /&gt;
    &amp;lt;module name="AppBar" layoutPanel="navigationHeader" /&amp;gt;&lt;BR /&gt;
    &amp;lt;module name="Message" layoutPanel="messaging"&amp;gt;&lt;BR /&gt;
        &amp;lt;param name="filter"&amp;gt;*&amp;lt;/param&amp;gt;&lt;BR /&gt;
        &amp;lt;param name="clearOnJobDispatch"&amp;gt;False&amp;lt;/param&amp;gt;&lt;BR /&gt;
        &amp;lt;param name="maxSize"&amp;gt;1&amp;lt;/param&amp;gt;&lt;BR /&gt;
    &amp;lt;/module&amp;gt;&lt;BR /&gt;
    &amp;lt;module name="HiddenSearch" layoutPanel="panel_row1_col1" group="Sythetic Transaction Recent Status" autoRun="True"&amp;gt;&lt;BR /&gt;
        &amp;lt;param name="search"&amp;gt;&lt;BR /&gt;
            &lt;CODE&gt;synthetics_transactionStatus(SyntheticTransaction)&lt;/CODE&gt;&amp;lt;/param&amp;gt;&lt;BR /&gt;
        &amp;lt;module name="SimpleResultsTable"&amp;gt;&lt;BR /&gt;
            &amp;lt;param name="displayRowNumbers"&amp;gt;off&amp;lt;/param&amp;gt;&lt;BR /&gt;
            &amp;lt;param name="drilldown"&amp;gt;row&amp;lt;/param&amp;gt;&lt;BR /&gt;
            &amp;lt;module name="HiddenSearch" layoutPanel="panel_row2_col1" group="Login Timing Last 4hrs"&amp;gt;&lt;BR /&gt;
                &amp;lt;param name="search"&amp;gt;&lt;CODE&gt;synthetics_transactionSteps($Transaction$)&lt;/CODE&gt;&amp;lt;/param&amp;gt;&lt;BR /&gt;
                &amp;lt;module name="ConvertToIntention"&amp;gt;&lt;BR /&gt;
                    &amp;lt;param name="intention"&amp;gt;&lt;BR /&gt;
                        &amp;lt;param name="name"&amp;gt;stringreplace&amp;lt;/param&amp;gt;&lt;BR /&gt;
                        &amp;lt;param name="arg"&amp;gt;&lt;BR /&gt;
                            &amp;lt;param name="Transaction"&amp;gt;&lt;BR /&gt;
                                &amp;lt;param name="value"&amp;gt;$click.value$&amp;lt;/param&amp;gt;&lt;BR /&gt;
                            &amp;lt;/param&amp;gt;&lt;BR /&gt;
                        &amp;lt;/param&amp;gt;&lt;BR /&gt;
                    &amp;lt;/param&amp;gt;&lt;BR /&gt;
                    &amp;lt;module name="ConvertToDrilldownSearch"&amp;gt;&lt;BR /&gt;
                        &amp;lt;module name="SimpleResultsTable"&amp;gt;&lt;BR /&gt;
                            &amp;lt;param name="displayRowNumbers"&amp;gt;off&amp;lt;/param&amp;gt;&lt;BR /&gt;
                            &amp;lt;param name="drilldown"&amp;gt;row&amp;lt;/param&amp;gt;&lt;BR /&gt;
                        &amp;lt;/module&amp;gt;&lt;BR /&gt;
                    &amp;lt;/module&amp;gt;&lt;BR /&gt;
                &amp;lt;/module&amp;gt;&lt;BR /&gt;
            &amp;lt;/module&amp;gt;&lt;BR /&gt;
        &amp;lt;/module&amp;gt;&lt;BR /&gt;
    &amp;lt;/module&amp;gt;&lt;BR /&gt;
&amp;lt;/view&amp;gt;&lt;/P&gt;

&lt;P&gt;Thanks in advance&lt;/P&gt;</description>
      <pubDate>Mon, 28 Sep 2020 12:40:03 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Drill-down-into-table-fields-for-display/m-p/98013#M5429</guid>
      <dc:creator>paddy3883</dc:creator>
      <dc:date>2020-09-28T12:40:03Z</dc:date>
    </item>
    <item>
      <title>Re: Drill down into table - fields for display</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Drill-down-into-table-fields-for-display/m-p/98014#M5430</link>
      <description>&lt;P&gt;I finally found a way around this, I had to explicitly specify fields within the second SimpleResultsTable module e.g.&lt;BR /&gt;
    &amp;lt;module name="SimpleResultsTable"&amp;gt;&lt;BR /&gt;
    &amp;lt;param name="fields"&amp;gt;StepName, Date, EventSeverity, Timing&amp;lt;/param&amp;gt;&lt;BR /&gt;
                            &amp;lt;param name="displayRowNumbers"&amp;gt;off&amp;lt;/param&amp;gt;&lt;BR /&gt;
                            &amp;lt;param name="drilldown"&amp;gt;row&amp;lt;/param&amp;gt;...&lt;/P&gt;</description>
      <pubDate>Tue, 23 Oct 2012 09:17:34 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Drill-down-into-table-fields-for-display/m-p/98014#M5430</guid>
      <dc:creator>paddy3883</dc:creator>
      <dc:date>2012-10-23T09:17:34Z</dc:date>
    </item>
    <item>
      <title>Re: Drill down into table - fields for display</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Drill-down-into-table-fields-for-display/m-p/98015#M5431</link>
      <description>&lt;P&gt;Nice post !&lt;/P&gt;</description>
      <pubDate>Fri, 30 Nov 2012 09:35:39 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Drill-down-into-table-fields-for-display/m-p/98015#M5431</guid>
      <dc:creator>aneeshkjm123</dc:creator>
      <dc:date>2012-11-30T09:35:39Z</dc:date>
    </item>
  </channel>
</rss>

